Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Categories

View all categories

Loading categories

CVE-2025-11844-smolagents — Educational sandbox and dynamic proof-of-concept scanner for CVE-2025-11844 XPath injection in Hugging Face smolagents library, enabling local data extraction and DOM traversal auditing. | Kitploit

Tools/

GitHub/sparshbiswas-ai/cve-2025-11844-smolagents

Vulnerability Analysis Code Analysis Web Application Exploitation CTF Penetration Testing Learning & Education

sparshbiswas-ai/cve-2025-11844-smolagents

CVE-2025-11844-smolagents

Educational sandbox and dynamic proof-of-concept scanner for CVE-2025-11844 XPath injection in Hugging Face smolagents library, enabling local data extraction and DOM traversal auditing.

View Repository

13 months ago

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

🔐 Smolagents XPath Injection Simulation Framework (CVE-2025-11844)

An educational auditing sandbox and dynamic proof-of-concept scanner demonstrating the XPath Injection vulnerability found within Hugging Face's smolagents library (up to version 1.2.0).

🔍 Vulnerability Profile

Metric	Details

CVE ID	CVE-2025-11844
Target Component	`search_item_ctrl_f` function inside `vision_web_browser.py`
Vulnerability Type	Improper Input Validation -> XPath Injection / DOM Breakout
Impact Scope	Local Data Extraction, Information Disclosure, Arbitrary DOM Traversal

🚨 Attack Vector Analysis

The target framework uses an un-sanitized string directly inside an internal XPath querying function:

root@kitploit:~

//*[contains(text(), 'USER_INPUT_HERE')]

Download Tool